DevThe Next Webabout 2 hours ago
Worm ChainDrop poisons npm via legitimate pipelines
1 min read
A self-spreading worm named ChainDrop tore through npm on Tuesday, poisoning hundreds of packages with over 1,300 trojanised versions. It hijacked the keyv developer's GitHub account, pushed poisoned code through legitimate release pipelines, and stole credentials from AWS, Kubernetes, Vault, and AI tools like Claude Code and Cursor.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
